CVE-2017-12156

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/aMoodle 3.xMoodle 3.x

References

Timeline

Published
Sep 18, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-121574.3In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.CVE-2017-121585.4It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker cCVE-2017-121597.5It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain acCVE-2017-121607.2It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication serveCVE-2017-121618.8It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset requeCVE-2017-121637.1An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.CVE-2017-121646.4A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled CVE-2017-121657.5It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possCVE-2017-121669.8OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly rCVE-2017-121675.5It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user tCVE-2017-121686.0The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause CVE-2017-121697.5It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote
CVE-2017-12156: Medium severity, CVSS 6.1 | Vulnix